CVE-2026-35309 is an easily exploitable vulnerability affecting Oracle Coherence, a component of Oracle Fusion Middleware. It impacts versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows unauthenticated attackers with network access over HTTP to compromise Oracle Coherence, potentially leading to full system takeover. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity with high confidentiality, integrity, and availability impacts. Oracle’s June 2026 Critical Security Patch Update addresses this vulnerability among 245 other security fixes. Oracle strongly recommends applying the patch immediately. Workarounds include blocking network protocols required for exploitation or restricting privileges, but these may disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can take over the affected product, potentially leading to unauthorized data access, modification, or denial of service.

Oracle has released security patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack or by removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security updates as per the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html.